Privacy Notice

Last updated: September 2026

1. Data Controller

HealthSignal is operated by heal.capital Management GmbH, a company registered in Berlin, Germany.

Contact Information:
heal.capital Management GmbH
Rosenthaler Str. 49
10178 Berlin, Germany
Email: info@healcapital.com

2. What Data We Collect

HealthSignal is designed to minimize data collection. We only collect:

• Server Logs: IP addresses, browser type, device information, and access timestamps for security and technical operation purposes
• Technical Data: Error logs and performance metrics necessary for service operation

We do not collect: Personal accounts, cookies, or any directly identifying information. Page-view counts and Vercel Web Analytics are aggregate; API-usage records are pseudonymous and store no raw IP address (see Section 8).

3. Legal Basis for Processing

We process your data based on:

• Legitimate Interest (Article 6(1)(f) GDPR): Server logs and technical data for security, system administration, and service improvement

4. How We Use Your Data

Your data is used solely for:

• Providing and maintaining the HealthSignal service
• Ensuring security and preventing abuse
• Technical troubleshooting and system improvements

We do not use your data for marketing, profiling, or any commercial purposes beyond service provision.

5. Data Sharing

We do not sell, rent, or share your personal data with third parties, except:

• Hosting & Analytics: Our hosting provider, Vercel Inc., processes server logs as part of infrastructure services and provides the cookieless Vercel Web Analytics service that reports aggregate visit metrics (see Section 8)
• Database: MongoDB Atlas hosts our application data as a processor under a data processing agreement
• AI processing: Anthropic PBC processes the text of published items to classify and summarise them (see Section 9). No visitor data is sent to Anthropic
• Legal Requirements: When required by German or EU law enforcement or regulatory authorities
• Service Protection: To prevent fraud, abuse, or threats to service security

Any data sharing is limited to what is legally required and technically necessary.

6. Data Retention

• Server and runtime logs: held by our hosting provider Vercel Inc. and deleted according to Vercel’s retention periods (see Vercel’s privacy policy). HealthSignal keeps no copy.
• Analytics records: first-party page-view and API-usage records (Section 8) are deleted automatically 90 days after collection.

7. Your Rights Under GDPR

As a data subject, you have the right to:

• Access: Request information about what personal data we hold about you
• Rectification: Correct any inaccurate or incomplete personal data
• Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Restriction: Limit how we process your personal data
• Objection: Object to processing based on legitimate interest

To exercise these rights, contact us at info@healcapital.com. We will respond within 30 days.

8. Cookies and Analytics

Cookies: HealthSignal sets no cookies and stores nothing on your device.

Analytics: We measure aggregate traffic in three ways. None of them collects names, accounts, or advertising identifiers:

• First-party page-view counts stored on our own infrastructure: the page path and a timestamp. No visitor identifier, no IP address, no device fingerprint.
• First-party API usage measurement. Requests to our machine-readable endpoints (/api/*, /feed.xml, /llms.txt, /openapi.json, /sitemap.xml) are recorded as the endpoint, method, response status, response time, referring page (the Referer header), and whether the caller looked automated. To count distinct callers without storing who they are, the IP address is passed through a one-way hash with a salt that changes every day; the raw IP address and user-agent are never stored, and yesterday's hashes cannot be linked to today's. These records are pseudonymous rather than fully anonymous, so the GDPR rights in Section 7 apply to them.
• Vercel Web Analytics, a cookieless analytics service provided by our hosting provider Vercel Inc., which reports aggregate visit metrics only.

Legal basis: legitimate interest (Article 6(1)(f) GDPR) in understanding aggregate usage. Because HealthSignal stores nothing on your device, no cookie-consent banner is required. If we ever add non-essential cookies or tracking, we will update this notice and implement a consent banner where legally required.

9. Content from Public Sources

HealthSignal reproduces titles and excerpts of documents published by official public bodies. These texts can contain personal data that the publisher made public, such as the names of officials, authors or speakers. We process them on the basis of legitimate interest (Article 6(1)(f) GDPR) in making public-sector health information easier to find. The text is sent to Anthropic PBC (United States) to classify it and to generate English titles and summaries. Stored items are kept for as long as the service lists them. You can object, or ask for an item to be corrected or removed, at info@healcapital.com.

10. International Data Transfers

We aim to process data within the European Economic Area (EEA). Some processors operate in the United States — notably Vercel Inc. (hosting and Web Analytics) and Anthropic PBC (processing of published source texts, Section 9). Such transfers are subject to appropriate safeguards under GDPR, including Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Vercel processes server logs, which include IP addresses, and Web Analytics data, which is aggregate.

11. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encrypted data transmission (HTTPS)
• Authenticated access to the database and admin tools
• Regular security updates and monitoring
• Data minimization and purpose limitation

12. Changes to This Notice

We may update this Privacy Notice to reflect changes in our practices or legal requirements. Material changes will be prominently posted on the website.

13. Supervisory Authority

You have the right to lodge a complaint with the relevant data protection supervisory authority:

Germany: Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin
Website: www.datenschutz-berlin.de

14. Contact Us

For any questions about this Privacy Notice or data protection matters:

Email: info@healcapital.com
Subject Line: "HealthSignal Privacy Inquiry"